AES-GCM and breaking it on nonce reuse

Post by hifromwork » Thu, Jun 13, 2024, 4:59 PM UTC

Raed667 wrote: post #15

WantonQuantum wrote: post #5

"At first glance, this seems fine, but it is not. If an attacker knows the plaintext p1 and the ciphertext c1, then they can compute the keystream by XORing p1 and c1 together" Also, if the attacker only has c1 and c2, if the nonce is reused then c1 xor c2 will be the same as p1 xor p2. In most cases, two plaintexts xored with each other are trivial to decode.

I made an entire "game" based on this concept (AES CTR though) https://aes-cpa.fly.dev/

Post by upofadown » Fri, Jun 14, 2024, 2:44 PM UTC

throw0101d wrote: post #44

upofadown wrote: post #30

Earlier quoted context omitted.

From the OCB FAQ[1]: >What happens if you repeat the nonce? You’re going to mess up authenticity for all future messages, and you’re going to mess up privacy for the messages that use the repeated nonce. The loss of privacy on OCB nonce reuse is not as severe. It would be more or less the same as with ECB mode. [1] https://www.cs.ucdavis.edu/~rogaway/ocb/ocb-faq.htm

The next few lines are: > It is the user’s obligation to ensure that nonces don’t repeat within a session. In settings where this is infeasible, OCB should not be used. But earlier in that section we have: > […] The nonce doesn’t have to be random or secret or unpredictable. It does have to be something new with each message you encrypt. A counter value will work for a nonce, and that is what is recommended. […] * ht…